linux-kernel - Re: [PATCH] printk: fix integer overflow in setup_log

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite for Android: free password hash cracker in your pocket

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Message-ID: <20181012090159.nmqcrodrxi66n2lz@pathway.suse.cz>
Date:   Fri, 12 Oct 2018 11:01:59 +0200
From:   Petr Mladek <pmladek@...e.com>
To:     Sergey Senozhatsky <sergey.senozhatsky@...il.com>
Cc:     Steven Rostedt <rostedt@...dmis.org>, linux-kernel@...r.kernel.org,
        Sergey Senozhatsky <sergey.senozhatsky.work@...il.com>
Subject: Re: [PATCH] printk: fix integer overflow in setup_log_buf()

On Wed 2018-10-10 20:33:08, Sergey Senozhatsky wrote:
> The way we calculate logbuf free space percentage overflows signed
> integer:
> 
> 	int free;
> 
> 	free = __LOG_BUF_LEN - log_next_idx;
> 	pr_info("early log buf free: %u(%u%%)\n",
> 		free, (free * 100) / __LOG_BUF_LEN);
> 
> We support LOG_BUF_LEN of up to 1<<25 bytes. Since setup_log_buf() is
> called during early init, logbuf is mostly empty, so
> 
> 	__LOG_BUF_LEN - log_next_idx
> 
> is close to 1<<25. Thus when we multiply it by 100, we overflow signed
> integer value range: 100 is 2^6 + 2^5 + 2^2.
> 
> Example, booting with LOG_BUF_LEN 1<<25 and log_buf_len=2G
> boot param:
> 
> [    0.075317] log_buf_len: -2147483648 bytes
> [    0.075319] early log buf free: 33549896(-28%)
> 
> Make "free" unsigned integer and use appropriate printk() specifier.
> 
> Signed-off-by: Sergey Senozhatsky <sergey.senozhatsky@...il.com>

I have pushed this fix into printk.git, for-4.20 branch.

> --- a/kernel/printk/printk.c
> +++ b/kernel/printk/printk.c
> @@ -1116,8 +1116,8 @@ void __init setup_log_buf(int early)
>  	memcpy(log_buf, __log_buf, __LOG_BUF_LEN);
>  	logbuf_unlock_irqrestore(flags);
>  
> -	pr_info("log_buf_len: %d bytes\n", log_buf_len);
> -	pr_info("early log buf free: %d(%d%%)\n",
> +	pr_info("log_buf_len: %u bytes\n", log_buf_len);
> +	pr_info("early log buf free: %u(%u%%)\n",
>  		free, (free * 100) / __LOG_BUF_LEN);
>  }

Please note that this 2nd hunk was already part of the commit
e6fe3e5b7d16e8f14 ("printk: Give error on attempt to set log
buffer length to over 2G"), see
https://git.kernel.org/pub/scm/linux/kernel/git/pmladek/printk.git/commit/?h=for-4.20&id=e6fe3e5b7d16e8f146a4ae7fe481bc6e97acde1e

Best Regards,
Petr